https://community.splunk.com/t5/Getting-Data-In/missing-fields-in-linux-installtion-compared-to-windows/m-p/80785#M97110 <P>How are you getting the logs to the linux box? Direct through a splunk forwarder or syslog or? Can you view the raw logs and see if the fields you seek are present? If you look at 'show source' within splunk are the fields present?</P> Thu, 14 Apr 2011 01:04:19 GMT netwrkr 2011-04-14T01:04:19Z https://community.splunk.com/t5/Getting-Data-In/missing-fields-in-linux-installtion-compared-to-windows/m-p/80784#M97109 <P>I had splunk running on a windows machine with my cisco asa 5505 sending syslogs too it and I was able to see destination ips and a bytes_in field but now ive moved to splunk to an ubuntu box, all the destinations ips are just our external ip and the bytes_in field seems to of disappeared completely</P> Wed, 13 Apr 2011 22:31:58 GMT https://community.splunk.com/t5/Getting-Data-In/missing-fields-in-linux-installtion-compared-to-windows/m-p/80784#M97109 terryblair 2011-04-13T22:31:58Z https://community.splunk.com/t5/Getting-Data-In/missing-fields-in-linux-installtion-compared-to-windows/m-p/80785#M97110 <P>How are you getting the logs to the linux box? Direct through a splunk forwarder or syslog or? Can you view the raw logs and see if the fields you seek are present? If you look at 'show source' within splunk are the fields present?</P> Thu, 14 Apr 2011 01:04:19 GMT https://community.splunk.com/t5/Getting-Data-In/missing-fields-in-linux-installtion-compared-to-windows/m-p/80785#M97110 netwrkr 2011-04-14T01:04:19Z